OpenMRS Security Assessment 2

Revision as of 20:33, 29 June 2016

Background:

OpenMRS is an open-source medical record management system. It is very popular in some parts of the world, but requires work to make it compatible with Department of Health and Human Services regulations authorized by the Health Insurance Portability and Accountability Act (HIPAA). This series of assignments aims to identify specific changes that are required to achieve HIPAA compliance to use OpenMRS in the context of a small medical practice or hospital. (Larger medical practices and hospitals typically have more complex situations and unique risks that require them to conduct their own assessment.)

Before beginning this assignment, students should be familiar with the material in a computer security textbook on risk assessment. We used Stallings and Brown, Computer Security: Principles and Practice, 3rd ed., Prentice Hall, 2015, chapter 14.

In this assignment, students use a Wiki to organize the questions they created in OpenMRS Security Assessment 1, in preparation for interviewing members of the OpenMRS community in OpenMRS Security Assessment 3. Wikis are commonly used by Free and Open Source Software projects for their documentation, so this assignment provides valuable experience with this tool.

The interviews themselves are conducted using Internet Relay Chat (IRC), a tool that enables open source developers all over the world communicate instantly, even if they have very low Internet bandwidth.

Directions:

In this assignment, you will be preparing for and conducting interviews. We will use the OpenMRS Security Assessment Wiki Interview Questions Template to organize and coordinate the interviews. This assignment must be completed in groups of 3–4 students.

Part 1

Due date: This part can be due a day or so OpenMRS Security Assessment 1.

Edit the OpenMRS Security Assessment Wiki Interview Questions Template, adding the questions that you prepared in part 5 of Project 4. I provided a bunch of categories of questions, based on the kinds of questions that are normally asked in a risk assessment like this. Feel free to add additional categories if your question does not really fit well. If another team asked a similar question, you do not need to add it again.

If another team has put a question in the wrong category, or if you think it could be worded better, please make the appropriate changes. This is a WIKI, after all.

Participation in this section is worth 10 points.

The instructor will review each of the proposed questions, and will approve questions that are respectful, appropriate and useful for this security assessment.

Part 2

Deadline: About 3 days after part 1. This allows 1 day for the instructor to review the questions and another 2 days for students to sign up.

Sign up for at least 2 approved questions per team by editing the WIKI page. See the instructions in the Template section at the bottom of the WIKI. You are not allowed to steal a question that another team has already signed up for.

Like most open source projects, OpenMRS uses IRC for much of the communication with developers and users. Read the OpenMRS IRC information. Work through the activity, Introduction to IRC: connect to the IRC server irc.freenode.net; chose an IRC handle that ends with "_psu"; join channel #OpenMRS; spend an hour lurking and watching the discussion that is happening in the IRC channel. During this time, it is important that your whole team is connected (either personally or as a group) and paying attention to the activity on IRC.

OpenMRS also uses the Talk WIKI for communication. This does not see as much real-time interaction, but provides for longer conversations. Take some time as a group to explore the conversations that have taken place here.

Write a short document (one to three paragraphs, 20 pts) that discusses:

1. What was going on in the IRC channel during this time.
2. What kinds of conversations took place in the Talk site?
3. What are the differences between the use of IRC and Talk pages?

Part 3 Due Tuesday 4/28

Connect again to the IRC channel #OpenMRS on Freenode. Lurk long enough to make sure that it seems appropriate to ask your interview questions. (Do not try to ask your questions while another team is asking questions or if something else important is being discussed.)

1. Use a handle that ends with "_psu," mostly so you can coordinate with your classmates.
2. Introduce yourself, saying that you are working on a class project at Plattsburgh State University. At the same time, ask one of your questions.
3. Wait for a reply. If there is no reply, make note on the course WIKI that there was no reply and try again about 3 hours later. If there is still no reply, record your second attempt on the course WIKI and you have completed the assignment.
4. If the reply raises other thoughts or questions, carry on a conversation with the other person or people on IRC that explores their answer in more detail.
5. Record the conversation on the course WIKI.
6. Find an appropriate place on the Talk pages to ask your second question. Ask it there. Put the link to the Talk page on the course WIKI.
7. If anyone responds to your question on the Talk page, copy the discussion into the course WIKI.

This part of the assignment is worth 30 points. Record your conversations on the OpenMRS Security Assessment Wiki Interview Questions Template, under the appropriate questions.

Deliverables:

1. Students propose questions on a common Wiki page.
2. Students submit a paragraph describing the activity they observed in the OpenMRS IRC channel over the course of an hour.
3. Students report the results of their interviews on the common Wiki page.

Assessment:

How will the activity be graded?

How will learning will be measured?

Include sample assessment questions/rubrics.

Comments:

Throughout this assignment, it refers to "Plattsburgh State University" and "_psu." These should be replaced with appropriate references to whatver school is using the assignment.

This assignment was not nearly as successful as I had hoped. I did not coordinate with the OpenMRS community before the assignment, and the IRC channels were too quiet when the students attempted this. The students found this very frustrating, as they were looking forward to talking to real OpenMRS developers!

The second time I ran the course, I had the students interact with both IRC and the OpenMRS Talk system. The result was more satisfying, but still needs some work.

There is a risk with this assignment that students may be banned from the IRC or talk systems. This can happen if they are mischievous, inquisitive, accidentally clueless. One time using this assignment, the whole site was banned from using the IRC, with no clear justification. The instructor should be in touch with OpenMRS in advance to negotiate how the student interactions will be policed.

Additional Information:

ACM Knowledge Area/Knowledge Unit	What ACM Computing Curricula 2013 knowledge area and units does this activity cover? ACM_Body_of_Knowledge
ACM Topic	What specific topics are addressed? The Computing Curriucula 2013 provides a list of topics - https://www.acm.org/education/CS2013-final-report.pdf
Level of Difficulty	Is this activity easy, medium or challenging?
Estimated Time to Completion	10 Hours
Materials/Environment	The instructor needs to create or otherwise provide access to a Wiki that the students can edit. Create a base page for this series of assignments, possibly based on the OpenMRS Security Assessment Wiki Template, and then create a page for this specific assignment, OpenMRS Security Assessment Wiki Interview Questions Template. Students need an IRC client, such as ChatZilla.
Author	Steven P. Crain
Source	N/A
License	This activity is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Suggestions for Open Source Community:

Suggestions for an open source community member who is working in conjunction with the instructor.

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License